Purchase Order-238643[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource
Purchase Order-238643.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Purchase Order-238643.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 8db47d7446c4f1d4d4ab99f0362f1dcdf1db0f4dbff396cfeaa567757fe91aab
MD5 f53b9f106dafcd070be130d5d3e4258b
SHA1 db884ac9fd61f47230c0704732bb12f762513b80
SHA512 506fcfa260c569157b51f8d2c34fb0067cc0749ad9b2e4eb835a4793cf434a6f11cd39960e213f27ea3e71fb10bdbee03b8bd5b46c3706438f57cabe81254da6
SSDEEP 12288:bT2Zk/EL2Yw/R+9xbxriVWRa8YskpCWCjNXfLNkVYW86joMAZHLlbbHOxQ2H1:bqefYwA9xb5y+k6jNXfLeGeJA7OxB
TLSH
T114E412B13A81CC67EE5497F02866843491F57CAC15E3870EE6EF7B3AA6F6381650F205
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

85:36:37:97:f7:0e:ec:6c:30:a5:ad:e9:51:26:8e:04:55:a5:ab:c5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Galoperet,OU=Skuffekomedies Scaurie\ ,O=Galoperet,C=FR,1.2.840.113549.1.9.1=#0c184f766572666c6f6473404f72646e756d72657338372e5365

Chains

May 19, 2026

CN=Galoperet,OU=Skuffekomedies Scaurie\ ,O=Galoperet,C=FR,1.2.840.113549.1.9.1=#0c184f766572666c6f6473404f72646e756d72657338372e5365

Minor OS version

0

Major OS version

4

Entry point

12785

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
MD5 c9473cb90d79a374b2ba6040ca16e45c
SHA1 ab95b54f12796dce57210d65f05124a6ed81234a
SHA512 eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b
SSDEEP 192:cPtkumJX7zBE2kGwfy9S9VkPsFQ1MZ1c:N7O2k5q9wA1MZa
TLSH
T1B2324C15031086F3E1D2853D682B39AB2FB969118AF04E438FB36952FE346C7AD79352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
SHA256 5157fe688cca27d348171bd5a8b117de348c0844ca5cb82bc68cbd7d873a3fdc
MD5 12465ce89d3853918ed3476d70223226
SHA1 4c9f4b8b77a254c2aeace08c78c1cffbb791640d
SHA512 20495270bcd0cae3102ffae0a3e783fad5f0218a5e844c767b07a10d2cfab2fab0afb5e07befa531ba466393a3d6255741f89c6def21ec2887234f49adceea2f
SSDEEP 96:oOYqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4L7qndYHnxss:oOYq+CP3uKrpyREs06YxA2dGn
TLSH
T1C4121A635A4455F3D5D7223A21AA2F2FD73C9324A062BC0287779E462BF431A7D3A341
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0
MD5 0a6f707fa22c3f3e5d1abb54b0894ad6
SHA1 610cb2c3623199d0d7461fc775297e23cef88c4e
SHA512 af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8
SSDEEP 96:e97GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgN0u3e:eBXhHR0aTQN4gRHdMqJVgN0N
TLSH
T130D1097675E22EB3C50ECA353C527A2B57F8C8111B9401549B938BD238C5EB3EA39282
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Analytikerforventninger/Convolved

SHA256 76c2544f5e590708fac41619fc5bd4d573f6c8d656e398e961a11a4ebbf93c94
MD5 6ee28a31c30c06056b8023ce47b98d78
SHA1 23fad22d63c188dfd1382a1b46b27f7f44e335c7
SHA512 27313ffe75c3c57be7777da8daa312813348ff34210e0158a7e26a98130c2d837a6d845dea1f7eb43f55accffc60fd237ec969bc3b63603698c1b813bfa8479f
SSDEEP 96:fy/jCXTUphyiV3t4TmpqagnK8eTXOK8Bl8csH5l40By9hrt1:fLXTxiV94TmgnKtT82csHo9hrt1
TLSH
T1DBC13B9AD7028CE5CD07753CF974B2B96B5C602A5F46E0E7914C104D936B3C51D361B3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Analytikerforventninger/Klvebrnde.ini

SHA256 1f6e5898f1061288fe5fac6dde419558efb675e8d88a14e7ea7b5ea4ddff54ed
MD5 2c34431203fb43972f6dbdecfb2fddd4
SHA1 45ea6b28653d499db2f753378cdb532c6a393f4e
SHA512 3e917be0f57d87ff1c92502a6adeb062983f04f4191c166e5945fc6942427643aa929a797c2f02fe97ca46795bade7bdd27b2166ce655222fe5b292da3d71f6a
TLSH
T182F0DDC0C5408EFD0D431B676E8618D245AE695B8ABAE672E1A786256468429E339228
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Analytikerforventninger/Skider201.ini

SHA256 74bf4859b0b9d806b3ca9860344da9bd25090832b121d4498752efa09e36ef2f
MD5 3387b12f417ce43e20582c3c9f9f2b00
SHA1 45ec848181defbc908a4874933882b25ba4bcd63
SHA512 49f4aef8e2413fd67ebdeb688f7a57d0237a601c125da52dfc38b7ae83e27fba6efc468f34b18bae708ff3b4c7b2cbc0a1329e1f71cd8aaa1ca8dd04e4b45b21
TLSH
T170F02034C6446B8E4F69AF39AE6A6086F42D3A8C03044019DD4347FF9B916AD6D7D310
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Analytikerforventninger/dandyish.txt

SHA256 7dc9571a7fb24dfa23d0d6302ff1b4fe0265a84433d96e0986385aff169e7c02
MD5 59884eca3dfb921267a2f518bf5c4002
SHA1 eb85a1daccd21ad7118e26b4e881253596bd2698
SHA512 d2efb302db45306d8f4364fd2d82d3227de0eaea80ede17844b10b64c9c698e92724d2765f028917fa7e96bcfdb8e00bf52f7509e493f7c640a9e2f5cfde9853
TLSH
T12BF0057EED05451D3612AAD955435D40C36C410CD9115760794F275DAC815D9539AF3C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Anthracosaurus/emnetidsskrifternes.txt

SHA256 4eceb60df0f4ca5accf67ecde1217819e46d314dcea2b238aede0ecdc3692947
MD5 ebc44f487785b2d86c353283f2a2e1ea
SHA1 3bffd0468c9b7f6cfc461d58c258f22b70d55f25
SHA512 d6b7baf384f0239277d4afa6d577d901d5662f098987ec5215c160ced2211d2caaa3703a5cb92d066ee8d586949ab6cf9e1b072a16f5b906c6098d17f1b64f64
TLSH
T134F06848ECA015040ECE06B504DC0035023E28593703F375FDED3A8E0503CACF776599
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Anthracosaurus/kasusendelse.txt

SHA256 90d076ef3c4e6648472e1426ec2dde754f5948ac33f86090e956df71b7f5ccfb
MD5 75014ed283094fb798f50487f44a5e98
SHA1 b81f1468671db01a994567ae6ce181f6f67fc0c8
SHA512 641913a42736adb8caf2a97f0c8490d56dcc7723127ae8bf93651e209ecee3d8f5a93732d91e8957c9e62e25c68cfb2b0b9ef9a1952a48280630d5f486579933
TLSH
T1EAF0D455164E156C9E1D839DDC05AC10F5795399C9472055D9DCD307174B70CC57C7B8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Anthracosaurus/paaskyndelsers.txt

SHA256 973033e3c5c273d2d47f382bd17a2f04b7c283d40e63622e0c383980e9217057
MD5 63b138c4077d544f0e17afa03f17a8e1
SHA1 cf3ca67c5a41f6f1f621f04650d16dea51fea6dc
SHA512 5b64f5855f7f1606d6108aae0ce1699a07d7aeb2225e07f98f5c5d2b91806375f044d47fb2a8322ef345441532cfa7358bc1560274ca1bd3840e5c208008b71a
TLSH
T196012380EF10A64A8AF2130BACC1C77241ECEC7F8F42012127F283620007114BBBD116
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Anthracosaurus/patrimonially.ini

SHA256 0c662d9743e351c5fb8a9d1263fee6f475b3c188a4f6d3a65eabe415800abeb6
MD5 b5d984aa1a3fa9764416697d7ffb3fab
SHA1 a1cad797494a336feb5e19cda99d6e3d5d6bb992
SHA512 e55799a7475ed96dba9bae8849dd98f5ca04b4a0aab6ca92b467b4e387e9f6d67028a5f59087351a7783724d89bf70bf5a814b8d44b8b01650b7a646715e5b2b
TLSH
T1C1D0E72844A15D0B1D385A44391120C117B5D3446434D572779027D83460118A35C337
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Anthracosaurus/precolourables.lou

SHA256 74c815b65790c75f6e2483485b199bc9e52f887988a0542473a002380e116bec
MD5 130f188f9f96dd7da3bf9a1225efeffd
SHA1 877bd74370722ecd73742cac0aa8337ea3320c44
SHA512 10da44dd9fc65b69d42057b9dde3a815e20a15a8b9b0cb51d55a30ce958a88ebd72693dbca5ee7d3eba44bc9dcbcf5a2464dd60b60a28c1a330ad29cf932752c
SSDEEP 768:0qmVPAnSigsQc12ye5FJRQ8OYmnomWT0PyYIOR0ZKECE32dMKdRG/hdoQ5nZrPLX:qjr4nulmuB
TLSH
T1EA66136884387813FEACC92C6984CA629E4D1535C9BFE7589064B17FD52022DFFB71A3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Anthracosaurus/sammenstyrtningsfarers.cic

SHA256 e949ba18b4e22a9846bb637ad04927335961c87f0788bd986f534bd020be789b
MD5 ddae0dd1564dfcc20d31c9d27f0bbfe3
SHA1 0afb255ef94fb6f4a582e6939ecc8460d570600b
SHA512 b3b3c95952ab2ade5265fe0085b6504b8cefe3276ae336e6fc1110ba8c04b45ac4970b9d5f59a0e7b991c5d06b90485553e06145d1a889fe38ad2c8d178ec9c3
SSDEEP 1536:ZsO8GUrAqwdQI73CPU7oBG0cuZPGMAtSpoAOLKOE/AB8IXns32O6pOPOQ4Ii6eCK:vb
TLSH
T1B5A50190450DEA569B9CB63F0CC4864D9FCF8EB0F6B6320BE8B1003998B376D1897D11
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Beboppers

SHA256 b231998cfeab06e63d3df53ece587985606bdf9bb7a4955b3fe15495aae335a4
MD5 aa054879c16e09cc7b20e6604934cd3c
SHA1 2f7d76f1be3cd3282715fb0fed4259ce4638da67
SHA512 73c6f9945b2e9bd54ebf24ae81bbc4d76a75bcbab4a667c2a80dd4897df8c236e8dea44ed39ba27cf968382eb2f1b0c7cad9ac161b02adff3dc73eba752fb010
SSDEEP 6144:8eIB6AX1y4yycHtavwTzj4QIBYZmFWvedPV9jzAv:8eIBN1yrP4FBYUFaeZHu
TLSH
T128440190F0CE84EBD77F54BCD624219B350B399A169AE38A10D1DDD87F5248AD8F902F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Purchase Order-238643.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Analytikerforventninger/Convolved

Analytikerforventninger/Klvebrnde.ini

Analytikerforventninger/Skider201.ini

Analytikerforventninger/dandyish.txt

Anthracosaurus/emnetidsskrifternes.txt

Anthracosaurus/kasusendelse.txt

Anthracosaurus/paaskyndelsers.txt

Anthracosaurus/patrimonially.ini

Anthracosaurus/precolourables.lou

Anthracosaurus/sammenstyrtningsfarers.cic

Beboppers

Sharing

General

Malware Config

Signatures

File Explorer

Purchase Order-238643.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

Analytikerforventninger/Convolved

Analytikerforventninger/Klvebrnde.ini

Analytikerforventninger/Skider201.ini

Analytikerforventninger/dandyish.txt

Anthracosaurus/emnetidsskrifternes.txt

Anthracosaurus/kasusendelse.txt

Anthracosaurus/paaskyndelsers.txt

Anthracosaurus/patrimonially.ini

Anthracosaurus/precolourables.lou

Anthracosaurus/sammenstyrtningsfarers.cic

Beboppers